Multiplatform CI governance foundation

[m1ngsama]

Summary

• split CI into fast PR gates, extended runtime validation, portable container builds, and package recipe validation
• add a release artifact gate that assembles binaries, the explicit release source archive, and checksums before draft release creation
• document CI/CD governance, manual deployment boundaries, package publishing gates, and staged supply-chain roadmap
• add regression coverage for release artifact packaging failures

Verification

• git diff --check
• workflow YAML parse check for .github/workflows/ci.yml and .github/workflows/release.yml
• ./test_release_artifact_gate.sh
• make script-test
• make release-check

Notes

This keeps production deployment and package-manager publishing manual. The first GitHub Actions run is expected to validate runner labels, Docker image pulls, and Alpine musl portability in the hosted CI environment.

[m1ngsama]

Manual full CI verification passed on run 26559456350 after the checkout@v6 update. Covered: PR gates on Ubuntu/macOS, extended Linux runtime with soak/slow-client, valgrind smoke, Alpine/Debian/Ubuntu container builds, and package recipe gate. Production deployment and package publishing remain manual.